61–70 of 175 posts
Earlier quoted context omitted.
I'm generally pretty fatalistic about avoiding state-level adversaries. So, in a sense, it doesn't really matter how one thinks a security countermeasure is going to stack up against an IC attacker. The important thing is that people understand how hard this is to do, and take that into consideration before adopting tools like these. You can easily make things worse for yourself. I think this post is a fun technical…
My first take is that it is terrible terrible opsec to talk about this sort of thing if you actually want to take it across a border or have any kind of "elevated" encounter with law enforcement or intelligence. Like if they have good tools for profiling you from your posts they'll totally expect the OP to have some interesting hardware and stories to tell. Contrast that to just being some boring guy who has a cover…
Earlier quoted context omitted.
This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware. But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day. But there is a big flaw I see: 8g…
> The XKCD version of password cracking works no matter how secure your hardware. Lavabit would like to enter the conversation.
Earlier quoted context omitted.
> If you're using off-the-shelf "hidden" encrypted volume schemes, you're not going to be evading state-level adversaries; I kinda assumed this was a solved problem now, up to the information-theoretic limit. Just create a FAT32 fs (for example), put some boring decoy files on it, and then unmount it. Traverse the FAT to map which blocks are in-use vs not-in-use, and use the not-in-use ones to store your encrypted da…
Doesn't FAT have the concept of "badblocks" to handle the old days when sectors could randomly fail on drives and they had to work around it? It would only be slightly more suspicious but it would allow the drive to be mounted and used as a regular drive to avoid the even more suspicious unmounted volume issue. The data in the sectors would obviously be encrypted so it looks like random noise if someone does start po…
I thought of a much simpler approach though. Personally, it's completely normal for my USB drives to contain some OS installer dd'd to the first few GB, and to be wiped with urandom between uses. The installer .iso is typically immutable and will never expand beyond its initial size. Rather than mess around with block mappings, I can just use last n GB as a hidden storage volume. dm-crypt "plain" mode is headerless and can be configured to start from some offset within the underlying block device.
The only giveaway here might be forensic examination of the drive's internal wear-leveling data.
Earlier quoted context omitted.
> The XKCD version of password cracking works no matter how secure your hardware. Lavabit would like to enter the conversation.
The xkcd approach worked in that case; the wrench in that case was legal, not physical, but boy would it have hurt nonetheless.
> As for the security of the device, I’ve verified things with functional tests like this
Otherwise great project!
Earlier quoted context omitted.
This isn't stand-up-to-state-actors security. This is keep-state-actors-from-noticing security. They know you're guilty, they'll get it. The XKCD version of password cracking works no matter how secure your hardware. But while states realistically can crack most anything it doesn't mean they can crack *every*thing. There are simply too many flash drives crossing the border every day. But there is a big flaw I see: 8g…
We're talking about exactly the same threat. What I'm pointing out is that state adversaries won't have to "notice" this; all they'll have to do is plug the device into a standard commercial forensics scanner product --- and we're stipulating that they're plugging the device in already (else what does it matter what bits are on it). They pay other people to notice this stuff for them!
Money, even at state level, is not some infinite resource (and neither is time).
States put effort into what they consider worth investigating - no state strip searches every incoming traveller, and goes through every item in their possession - it's possible for them to do, and if they did they'd find a hang of a lot more contraband, but it's costly, time consuming, and politically risky.
Earlier quoted context omitted.
Be careful in countries like UK which have laws requiring the decryption of any data they find. There are people sitting in jail because they couldn't decrypt the "random noise" on their computers.
There literally are not. Anyone competent enough to be an expert witness will be able to plainly explain to everyone else how statistical analysis obviously delinates the difference between truly random noise and an encrypted volume.
A LUKS volume with a detached header is indistinguishable from random data.
>Many places don’t respect privacy laws, in certain situations you may be forced to unencrypt your media, or worse, assumed to be guilty. A Veracrypt hidden volume is useful in the former situation, but not the latter. > ... >Due to AI demand the cost of eMMC memory is unusually high, so I chose to go with an SD card for memory. Someone will find your SD card if they tear it apart, but of course everything is encrypt…